April

Tornado

Tornado Cash

Drift

Cash

<p style="text-align: justify">The Drift Protocol exploiter has transferred approximately $109 million in <a href="https://en.coin-turk.com/whales-execute-massive-ethereum-sales-worth-113-million/" rel="noopener noreferrer nofollow">Ethereum</a> to Tornado Cash over the past two days, heightening concerns about the movement of funds stolen in one of the largest decentralized finance attacks this year.</p>
<h2 id="details-of-recent-ethereum-transfers">Details of Recent Ethereum Transfers</h2>
<p style="text-align: justify">Blockchain analytics platform Onchain Lens reported that addresses controlled by the Drift exploiter sent a total of 44,510 ETH to Tornado Cash between October 20 and 21. The transfers consisted of 25,710 ETH, worth around $63 million, on October 20, followed by 18,800 ETH, valued at roughly $46 million, on the following day.</p>
<p style="text-align: justify">These movements account for more than one-third of the $295.7 million equivalent stolen in April during the Drift Protocol exploit. Analyst data shows the exploiter’s wallets now hold close to 56,569 ETH, with the balance estimated at about $138 million as of October 21, according to Arkham Intelligence.</p>
<p style="text-align: justify">Records from Tuesday indicate that the exploiter’s monitored balance was near 81,454 ETH, which represented approximately $194 million. This reduction reflects a combination of outgoing transfers and fluctuating Ether prices.</p>
<h2 id="ongoing-use-of-tornado-cash">Ongoing Use of Tornado Cash</h2>
<p style="text-align: justify">The Drift exploiter has previously used Tornado Cash to obscure transactions. In August, linked wallets sent approximately $44 million in ETH through the mixer. On October 20, Lookonchain identified an influx of about 25,700 ETH sent to the service within just two hours. Additional transfers continued through October 21, tracked across various blockchain monitoring tools.</p>
<blockquote>
 <p>Recent blockchain activity demonstrates an ongoing effort by the Drift exploiter to move substantial amounts of stolen funds through Tornado Cash, underscoring the complexity of tracing assets once they enter mixing services.</p>
</blockquote>
<p style="text-align: justify">Analysts caution that blockchain analysis alone may not be sufficient to identify the eventual recipients of funds leaving Tornado Cash, creating ongoing challenges for investigators and affected users.</p>
<h2 id="aftermath-of-the-april-exploit">Aftermath of the April Exploit</h2>
<p style="text-align: justify">The Drift Protocol suffered a $295.7 million loss on April 1. Discrepancies in early loss estimates reflected differences in token valuations over time. The attack stands as one of the largest in the decentralized finance ecosystem during 2024.</p>
<p style="text-align: justify">A June 3 update from Drift highlighted findings provided by Mandiant, which linked the incident to North Korean threat actor UNC6862 through operational evidence and analysis of prior attack patterns. The attackers had reportedly spent months building relationships with platform contributors before launching the exploit, which involved transaction approvals and access compromise rather than vulnerabilities in the smart contract code.</p>
<p style="text-align: justify">In response to the attack, Drift hired former Helium executive Noah Prince to oversee engineering and brought in staff from Gauntlet to review the protocol’s risk management and liquidation systems. The platform is moving to restart trading operations and intends to dedicate part of its future revenue to compensate victims of the hack. However, any funds moved by the exploiter function independently from these recovery efforts.</p>
<h2 id="user-compensation-and-recovery-mechanisms">User Compensation and Recovery Mechanisms</h2>
<p style="text-align: justify">Drift’s compensation process began on October 1 with the issuance of DFX tokens on <a href="https://en.coin-turk.com/solana-ignites-the-market-with-impressive-etf-debut/" rel="noopener noreferrer nofollow">Solana</a>. These tokens allow verified users to redeem one DFX for every USDT lost during the exploit, with a capped supply of about 299.5 million DFX.</p>
<p style="text-align: justify">At the onset, approximately 3.1 million USDT was available in the recovery pool, setting the initial redemption value at $0.0104 per DFX. This structure means that direct recovery to pre-hack balances will not happen instantly, and the real value received depends on available funds.</p>
<blockquote>
 <p>Compensation options allow affected users to redeem DFX tokens against pool funds, sell their tokens, or hold them with the prospect of future value. Burned tokens are permanently removed from circulation as they are redeemed.</p>
</blockquote>
<p style="text-align: justify">The recovery system allocates between 60% and 90% of Drift’s daily net revenue to the recovery pool, depending on performance. In addition, any assets recovered through legal measures will be added to compensatory funds. <a href="https://en.coin-turk.com/bitcoin-could-fall-to-10000-warns-bloomberg-strategist/" rel="noopener noreferrer nofollow">Tether</a> has pledged up to 127.5 million USDT in assistance, with further commitments of up to 20 million USDT from other sources.</p>
<p style="text-align: justify">Nevertheless, these contributions are not yet available for redemption. Eligible users must claim their DFX tokens before January 1, 2028; any unclaimed tokens will be permanently burned afterward.</p>
<p style="text-align: justify">As the crypto market shows how quickly funds and meme tokens can gain momentum, timing and investor decisions remain critical. In the meme token sector, viral internet trends have transformed modest investments into substantial profits within days. Data from <a href="https://fomo.family/r/btcboos" rel="noopener noreferrer nofollow">Fomo App</a> illustrates this with an instance where a $99 investment in “Niu Lai” grew to about $370,000. Tools like Fomo App, which integrate token discovery, investor rankings, and trade notifications, offer traders a way to closely follow investor movements and activity in the fast-paced world of meme tokens.</p>
<p>The post <a href="https://en.coin-turk.com/drift-protocol-exploiter-moves-109-million-in-eth-to-tornado-cash/" rel="noopener noreferrer nofollow">Drift Protocol exploiter moves $109 million in ETH to Tornado Cash</a> appeared first on <a href="https://en.coin-turk.com" rel="noopener noreferrer nofollow">COINTURK NEWS</a>.</p>

Drift Protocol exploiter moves $109 million in ETH to Tornado Cash

Table of Contents

COINTURK NEWS

Other articles published on Oct 21, 2026

Join our free newsletter for daily crypto updates!